Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
Advisories for Npm/Hoek package
2022
2018
Prototype pollution attack
The merge function, and the applyToDefaults and applyToDefaultsWithShallow functions which leverage merge behind the scenes, are vulnerable to a prototype pollution attack when provided an unvalidated payload created from a JSON string containing the proto property.